MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b040e1a6476b048f7521c9d194933341bdbb9a5dc71697820fa3df9dde6e6da9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b040e1a6476b048f7521c9d194933341bdbb9a5dc71697820fa3df9dde6e6da9
SHA3-384 hash:	5eba5334f3f0c8be25dfa7e8b36a8d87cf918a3fa54deb8af92218fbff7afe6e13e834a24cf76fb4cceea5c46fe81ab7
SHA1 hash:	36d2696ceb35bdd5ab60a8a11c57d2b78df1b6a7
MD5 hash:	1e97a975275763d314588b7f4a773178
humanhash:	bacon-echo-angel-nevada
File name:	Demon.x86
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	94'842 bytes
First seen:	2026-04-18 07:52:32 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	1536:E70qEo336pR+ABHnc+G4/CqaeFK7+VWOm5fUVs3/L53unXmSHsbOmIct90ymc:Kd3KL+UHnh/CqjWtJUC/l3uXmGsbOm/B
TLSH	T10693091F975581ABC89746B607CFF63A4C33B8362B65A1453386BD9C2F07ACC8D29385
telfhash	t14b11af0371b6851d77b268248dfc4bb016a22b377361beb5bf1dc5849937002e979e8b
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	adliwahid
Tags:	gafgyt mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

67

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30395.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.29227.LC.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.28940.LC.UNOFFICIAL

Alert

Create hunting rule

Unix.Dropper.Mirai-7139232-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7344683-0

Alert

Create hunting rule

Unix.Dropper.Mirai-7540662-0

Alert

Create hunting rule

Unix.Trojan.Gafgyt-7643791-0

Alert

Create hunting rule

Unix.Trojan.Mirai-9934778-0

Alert

Create hunting rule

Unix.Trojan.Mirai-5607483-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Runs as daemon

Connection attempt

Performs a bruteforce attack in the network

FileScan.io

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.64.le

First seen:

2026-04-18T02:22:00Z UTC

Last seen:

2026-04-18T05:09:00Z UTC

Hits:

~10

Detections:

HEUR:Backdoor.Linux.Gafgyt.bl HEUR:Backdoor.Linux.Gafgyt.bj HEUR:Backdoor.Linux.Mirai.h HEUR:Backdoor.Linux.Gafgyt.gen

Link:

https://opentip.kaspersky.com/b040e1a6476b048f7521c9d194933341bdbb9a5dc71697820fa3df9dde6e6da9/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/69f6f64f-137f-45bc-be90-4f5e0278bd25

Behavior Graph:

Download SVG

Intezer Gafgyt

Malware family:

Gafgyt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9e623aaa-addb-4e84-a91f-5b0a53564e6f

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/b040e1a6476b048f7521c9d194933341bdbb9a5dc71697820fa3df9dde6e6da9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b040e1a6476b048f7521c9d194933341bdbb9a5dc71697820fa3df9dde6e6da9/

Neiki Family.MIRAI

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/b040e1a6476b048f7521c9d194933341bdbb9a5dc71697820fa3df9dde6e6da9

ReversingLabs TitaniumCloud Linux.Backdoor.Gafgyt

Threat name:

Linux.Backdoor.Gafgyt

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-18 07:53:37 UTC

File Type:

ELF64 Little (Exe)

AV detection:

23 of 38 (60.53%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wbaodjshnmci65jbzhizjeztig63xgs5y4ljpaqpuppz3xtonwuq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

discovery linux

Link:

https://tria.ge/reports/260418-jq8bpaay8s/

Behaviour

Reads system network configuration

Creates a large amount of network flows

Reads system routing table

Contacts a large (3863) amount of remote hosts

VMRay Gafgyt

Malware family:

Gafgyt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b040e1a6476b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.84

Link:

https://yomi.yoroi.company/submissions/b040e1a6476b048f7521c9d194933341bdbb9a5dc71697820fa3df9dde6e6da9